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IN THE CLAIMS 

This listing of claims will replace all prior versions, and listings, of claims in the 
application. 

Please amend the claims as follows: 

1. (Previously Presented) An apparatus comprising: 

a network interface module to connect the apparatus to a network; 

a packet capture module to intercept packets being transmitted on the network; 

an object assembly module to reconstruct flows representing objects being transmitted 
on the network from the intercepted packets, the packets associated with a document that 
includes the objects, wherein the document is captured based on a capture rule that 
specifies the objects, and wherein a determination is made as to whether to discard or to 
store the objects of the document; 

an object classification module to determine a type of content of and reconstruct 
objects from the flows; 

an object store module to store the objects; and 

a user interface to enable a user to search objects stored in the object store module, 
wherein the objects are searched based on a query, which includes search criteria used to 
identify selected objects that match the search criteria. 

2. (Original) The apparatus of claim 1, wherein the object assembly module 
comprises a reassembler to assemble the intercepted packets into flows. 

3. (Original) The apparatus of claim 2, wherein the object assembly module further 
comprises a protocol demultiplexer to sort the assembled flows by protocol. 
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4. (Original) The apparatus of claim 3, wherein the object assembly module further 
comprises a protocol classifier to extract the objects from the sorted assembled flows. 

5. (Original) The apparatus of claim 1, wherein the object classification module 
determines whether objects are stored in the object store or discarded based on one or more 
capture rules. 

6. (Original) The apparatus of claim 5, wherein the capture rules are user- 
configurable through the user interface. 

7. (Original) The apparatus of claim 1, wherein the object classification module 
determines a location that each object is stored in the object store based on the type of 
content of each object. 

8. (Original) The apparatus of claim 1, wherein the object classification module 
determines the type of content of each object using a signature of each object. 

9. (Original) The apparatus of claim 1, wherein the user interface comprises a 
graphical user interface. 

10. (Original) The apparatus of claim 1, wherein the object store module comprises 
a content store to store the objects and a tag store to index the objects stored in the object 
store. 

11. (Original) The apparatus of claim 10, wherein the content store comprises a 
canonical storage, and the tag store comprises a database. 
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12. (Previously Presented) A method comprising: 
intercepting data being transmitted on a network; 

reconstructing flows of objects being transmitted on the network from the intercepted 

data; 

classifying the reconstructed objects by content type, the data associated with a 
document that includes the objects, wherein the document is captured based on a 
capture rule that specifies the objects, and wherein a determination is made as to 
whether to discard or to store the objects of the document; 

creating a tag to describe each reconstructed object; 

storing the classified objects and tags; and 

indexing the stored objects to enable searching of the stored objects via the tags, 
wherein the objects are searched based on a query, which includes search criteria used to 
identify selected objects that match the search criteria. 

13. (Previously Presented) The method of claim 12, wherein reconstructing the 
objects comprises: 

sorting the intercepted data into packets; and 
sorting the assembled flows by protocol. 

14. (Original) The method of claim 12, further comprising determining whether each 
object is to be stored based on a set of one or more capture rules. 

15. (Original) The method of claim 12, further comprising receiving a query over the 
stored objects. 
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16. (Original) The method of claim 15, further comprising searching the indexed 
objects, and retrieving objects matching the query. 
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17. (Previously Presented) A machine-readable storage medium having stored 
thereon data representing instructions that, when executed by a processor, cause the 
processor to perform operations comprising: 

intercepting data being transmitted on a network; 

reconstructing flows of objects being transmitted on the network from the intercepted 

data; 

classifying the reconstructed objects by content type, the data associated with a 
document that includes a plurality of objects that identify characteristics of the 
document, wherein the document is captured based on a capture rule that specifies the 
objects, and wherein a determination is made as to whether to discard or to store the 
objects of the document; 

creating a tag to describe each reconstructed object; 

storing the classified objects and tags; and 

indexing the stored objects to enable searching of the stored objects via the tags, 
wherein the objects are searched based on a query, which includes search criteria used to 
identify selected objects that match the search criteria. 

18. (Previously Presented) The machine-readable storage medium of claim 17, 
wherein reconstructing the objects comprises: 

sorting the intercepted data into packets; and 
sorting the assembled flows by protocol. 



19. (Previously Presented) The machine-readable storage medium of claim 17, 
wherein the instructions further cause the processor to determine whether each object is to be 
stored based on a set of one or more capture rules. 
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20. (Previously Presented) The machine-readable storage medium of claim 17, 
wherein the instructions further cause the processor to receive a query over the stored objects, 
search the indexed objects in response to the query, and retrieve objects matching the query. 



